The security of the police National DNA Database is in question following the disclosure of confidential emails which reveal that a private firm has secretly been keeping the genetic samples and personal details of hundreds of thousands of arrested people.

Police forces use the company LGC to analyse DNA samples taken from people they arrest. LGC then supplies the information to the National DNA Database. Yet rather than destroy this afterwards, the firm has kept copies, together with highly personal demographic details of the individuals including their names, ages, skin colour and addresses.

In a separate twist, evidence has emerged that the Home Office has given permission for a controversial genetic study to be undertaken using the DNA samples on the police database to see if it is possible to predict a suspect's ethnic background or skin colour from them. Permission has been given for the DNA being collected on the police database to be used in 20 research studies.

These latest disclosures, which were unearthed following a series of Freedom of Information Act requests by The Observer and the campaign group GeneWatch, will give rise to fears that many DNA samples being collected by police from innocent people could be misused. 'Britain's DNA database is spiralling out of control,' said Dr Helen Wallace, deputy director of GeneWatch. 'Thousands of innocent people, including children and victims of crime, are taking part in controversial genetic research without their knowledge or consent.'

With almost 3 million samples, Britain's DNA database is the largest in the world, as police are allowed to retain DNA from anyone arrested whether or not they are found guilty of a crime. It contains more than 50,000 DNA samples taken from children. As the database has grown, ministers have reassured MPs and civil liberties groups that it is tightly controlled. But emails from LGC to the Home Office, seen by The Observer, suggest this is not the case.

The Home Office emailed LGC with its concerns: 'From a [DNA Database] custodian and Data Protection Act perspective, it is important that there are no demographics linked to these retained profiles. Otherwise, suppliers would be building up subsets of the National DNA Database.' The company admits that is has been doing this. It states: 'All the information is on [our system]. We do in effect have a mini-database.' One of LGC's directors is Lord Stevens, the former Metropolitan Police Commissioner, and it has several contracts with companies in the pharmaceutical, biotech and chemicals industry. Although there is no evidence that the firm has used the DNA records for other commercial purposes, opposition MPs are calling for the Home Office to launch an investigation. Lynne Featherstone, the home affairs spokesman for the Liberal Democrats, said: 'This might be more cock-up than conspiracy, but the Home Office must investigate whether DNA taken from thousands of innocent people has not been abused.'

She also expressed concern that the Home Office is allowing the database to be used for research that aims to try to build a 'genetic Photofit' from DNA samples found at a crime scene. She said: 'Anything that links black and ethnic genetic groups to criminality is potentially dangerous. How long before scientists start looking for a criminal gene?'

The genetic research is being carried out by Jon Wetton of the Forensic Science Service. An FSS spokesperson said the aim of the research was to reduce the time taken to identify a suspect .'

A spokesperson for LGC denied it had done anything wrong, saying: 'We are required by our police customers to retain the unused or replicate parts of samples in case we are required by them to carry out further analysis.' A Home office spokesman added the DNA samples were held for 'operational reasons'.